CERTIFICATION IN BUSINESS CONTINUITY by
Walter G. Green III, Ph.D., SRP, CBCP Associate Professor of Emergency Management
University of Richmond
A Paper Presented At The Partners In Emergency Preparedness Conference
Seattle, Washington April 22, 2003
CERTIFICATION IN BUSINESS CONTINUITY By
Walter G. Green III, Ph.D., SRP, CBCP Associate Professor of Emergency Management
University of Richmond [email protected]
A BRIEF OVERVIEW OF CERTIFICATION
Although this paper uses “certification” as the basis for discussion, not all programs discussed are certification programs. Because one uses the British model of levels of society membership, a more accurate term might be credentialing, in that both the five certification programs and the one membership program offer a business continuity credential to their participants.
What Is Business Continuity?
One of the difficulties in offering a certification process is defining business continuity. How you view business continuity determines how you certify business continuity professionals. Where business continuity belongs in a business, its contribution to strategy or processes, and whether it is a technical or managerial function, all shape certification philosophies.
The Explosion of Certification
Certification as a means of credentialing dates to the 1920s. However, the modern expansion of the certification industry dates to the 1960s - more than 78% of the certification programs available today having been founded in the last 40 years, with consistent growth each decade. Barnhart (1997) and Martinez (2001) list hundreds of general and information technology certifications – an estimated 700 reasonably accepted certifications exist varying from handfuls of certificate holders to in the vicinity of 70,000 (Green 1999).
What Does Certification Mean?
In generally accepted usage, certification is an independent evaluation of knowledge and skills that the certifying body has determined to be important to a form of activity. At the same time certification has specific features that are of benefit to anyone who holds a certification.
• Independent verification means certification is not tied to a specific job or employer. The knowledge and skills involved are applicable industry wide (even if narrow in scope).
• Certification offers employers or potential employers assurance that job experience, training, and education have prepared you to perform at a specific level.
• Certification may offer corporate or personal marketing advantages and may demonstrate due regard by a business.
• Certification is portable. You may take it with you wherever you go.
• Certification represents either a significant investment (if you pay the fees) or a significant benefit (if your employer pays the fees). Certification programs are not inexpensive, and maintaining certification is both expensive and time consuming.
The Perils and Pitfalls
Choice of certification is a highly personal process, based on your values, your career plan, and your assessment of the industry. Based on experience in other industries, you should consider the following factors when you make a certification program selection.
• Never earn a certification you cannot backup with job performance. If you cannot perform at the level of the certification, your future is limited (Guzman 2003).
• Know the reputation of the certification and the organization that provides it – not just at your level, but more importantly what senior management in your company thinks of it.
• Look for certifications that provide value added beyond being able to say you are one. Does the credential help you understand your skills and development needs?
• Match certification philosophy with your view of the industry. At least two programs view business continuity as a business strategy component. If you think of business continuity as part of information technology, these may not be your best choices.
• More may or may not be better. A long string of letters behind your name means a significant cost in meeting various currency requirements. At some point employers may start to ask what those all mean and whether you can actually do all of the skills.
THE MODELS OF BUSINESS CONTINUITY CERTIFICATION
Today six programs provide professional credentialing for business continuity Practitioners. Each program has a unique model with significant differences in its approach. As far as business continuity professionals are concerned, three appear to be vendor programs (Disaster Recovery Institute International, Institute of Education, and MLC & Associates, Inc.) and three vendor-neutral (Business Continuity Institute, Certified Recovery Planner, Brainbench Certified in Disaster Recovery and Planning) (Brainbench 2003b).
Membership Organization Model – The Business Continuity Institute, based in the United Kingdom, with members in North America and Europe, is a membership organization. Members are admitted based on their experience and accomplishments, and, as part of their professional development, progress to higher grades within the society. This model is closely linked to the current ten elements of the Common Body of Knowledge. At: http://www.thebci.org.
Table 1. Program Credential Elements Certified Recovery Planner Business Continuity Institute Disaster Recovery Institute International Institute of
Education Associates, MLC and Inc. Brainbench Established 1994 1994 1989 2001 2000 2001 Entry Level Recovery Planning Associate (RPA) Associate of the Business Continuity Institute (ABCI) Associate Business Continuity Planner (ABCP) Associate Continuity Professional (ACP) n/a n/a Fully Qualified Level Certified Recovery Planner (CRP) Member of the Business Continuity Institute (MBCI) Certified Business Continuity Professional (CBCP) n/a Certified Continuity Program Developer (CCPD) Certified in Disaster Recovery and Planning Senior Level Senior Recovery Planner (SRP)
n/a n/a n/a n/a n/a
Master Practitioner Level Master Recovery Planner (MRP) Fellow of the Business Continuity Institute (FBCI) Master Business Continuity Professional (MBCP)
n/a n/a Master in Disaster Recovery
and Planning
Note: The Institute of Education planned to introduce a Certified Continuity Professional certification in 2003, but confirmation of its availability was not available at the time this paper was completed (Institute of Education 2002b).
Professional Development Model – The University of Richmond’s Certified Recovery Planner certification program is based on personal self-assessment, open book testing, and case studies to provide a framework for knowledge and capability assessment and professional development planning. This model is based on a set of 19 competencies for business continuity professionals and is structured to encourage career progression. At: http://www.recoveryplanner.org.
Education and Testing Model – The Disaster Recovery Institute International incorporates the delivery of educational courses, including specific certification preparatory courses, with certification based on testing and experience. Although DRII course attendance is not required for testing, over 12,000 individuals have completed DRII courses. This model is closely linked to the current ten elements of the Common Body of Knowledge. At: http://www.drii.org.
Table 2. Requirements
Experience Service Credentialing Process
RPA less than 2 years
none self assessment;
online test 1 – terminology and principles;
online test 2 – processes and project management CRP minimum
of 2 years
none self assessment;
online test 1 – terminology and principles;
online test 2 – processes and project management; online test 3 – program management and strategy; continuity plan case study
SRP minimum of 6 years
4 years as CRP
self assessment at each 2 year renewal; either case study, major project, or current developments examination at each 2 year renewal MRP minimum
of 6 years
none documented self assessment;
online test 1 – terminology and principles;
online test 2 – processes and project management; online test 3 – program management and strategy; continuity plan case study; program management case study; interview
ABCI full-time or part time experience
none scored assessment of documentation and narrative
MBCI minimum of 2 years
none scored assessment of documentation and narrative FBCI minimum
of 5 years
2 years as MBCI
scored assessment of documentation and narrative; structured interview
ABCP less than 2 years
none complete certification examination with minimum score of 75
CBCP minimum of 2 years
none document experience in 3 of 10 areas of common body of knowledge; complete certification examination with minimum score of 75
MBCP minimum of 5 years
none document experience in 7 of 10 areas of common body of knowledge; complete certification examination with minimum score of 85; case study or directed research project
ACP none none complete 6 online courses, each of approximately 8 hours duration
CCPD not addressed
none complete 3 courses of 16 weeks duration online Brainbench
Master none none pass 40 question adaptive online examination with score of 4.0 on a scale of 1.0 to 5.0 Brainbench
Course Completion Model – The Institute of Education, affiliated with Global Continuity, basis certification on completion of a series of course modules that follow a definition of business continuity as a system activity. There is no overall end of training examination. At: http://www.ioeducation.com.
Proprietary Method Model – MLC & Associates, Inc. bases certification on completion of three in-depth courses based on their proprietary model of business continuity and the use of specific software designed by Jitlia Solutions, Inc. (MLC & Associates 2002, 2003). At: http://www8. iwebcenters.com/mlcassociatesinc/training_cert.ivnu.
Commercial Testing Model – Brainbench, a commercial vendor of online testing offering a wide variety of certifications, with an information technology concentration, offers disaster recovery certification on the same model as their other certifications - log on, take a test, be certified. At: http://www.brainbench.com.
Table 3. Numbers Certified Certified Recovery Planner (2003) Business Continuity Institute (2002) Disaster Recovery Institute International (2002) Institute of Education (2002) MLC and Associates, Inc. (2002) Brainbench (2003)
Entry 2 ABCI 165 not reported confidential n/a n/a Fully
Qualified
CRP 153 MBCI 480 CBCP 2700+ n/a CCPD 8 1174 tested Senior
Practitioner
2 n/a n/a n/a n/a not
differentiated Master
Practitioner
1 FBCI 115 MBCP 40+ n/a n/a
Table 4. Certification Program Fees – Fully Qualified Credential Certified Recovery Planner (2003) Business Continuity Institute (2002-2003) Disaster Recovery Institute International (2003) Institute of Education (2002) MLC and Associates, Inc. (2002) Brainbench (2003)
Course Fees 0 0 0 ACP:
$1275 $6,475 0 Examination Fees $300 0 $250 0 0 $49.95 Application Fees 0 $80 $250 0 0 0 Membership Fees 0 $157 0 0 0 0 Total Cost $300 $237 $500 $1275 $6,475 $49.95
Notes: Institute of Education course prices quoted are based on package pricing for the entire program. MLC and Associates, Inc. pricing includes required software.
PREPARING FOR CERTIFICATION What Does Certification Examine?
To understand how to prepare for a credentialing process you have to understand what the process purports to evaluate. There are two published examples of knowledge or skills based certification content. In addition, Brainbench provides a topic list (Brainbench 2003a).
Table 5. Testing The Common Body of Knowledge Certified
Recovery Planner Continuity Business Institute
Disaster Recovery Institute International
Brainbench
Written Test yes – open book - also tests other factors listed in the
19 competencies no yes no – tests Brainbench’s list of 10 topics Demonstration of Experience yes – primarily to assist certificate holder in self-assessment and career planning yes – narrative submission – all 10 areas required at different levels of mastery for Member and Fellow levels yes – assessed through narrative submission – 3 areas required for
CBCP, 7 areas required for MBCP
no
Interview yes – for Master Recovery Planner
yes – for Fellow no no
The Common Body of Knowledge
Both the Business Continuity Institute and the Disaster Recovery Institute International base their credentialing process on a ten element common body of knowledge, defined in a cooperative process between the two organizations. The Common Body of Knowledge includes (The Business Continuity Institute 2001b):
1. Project initiation and management 2. Risk evaluation and control 3. Business impact analysis
4. Developing business continuity strategies 5. Emergency response and operations
6. Developing and implementing business continuity plans 7. Awareness and training programs
9. Public relations and crisis coordination 10. Coordination with public authorities
Certified Recovery Planner Competencies
The Certified Recovery Planner program uses a competency-based model in its examination program, testing 19 competencies (University of Richmond 2003):
1. Advocate business continuity as a core strategic element.
2. Establish, organize, budget for, and manage the business continuity function. 3. Identify and describe organizational systems and business processes.
4. Assess natural, technological, and security hazards and identify threats. 5. Conduct a business impact analysis.
6. Assure compliance with applicable laws, regulations, and standards.
7. Identify strategies for the preservation of organizational assets and capabilities. 8. Identify requirements for contractor support for facilities and critical services. 9. Coordinate the development and approval of a business continuity plan. 10. Coordinate planning with governmental emergency management.
11. Support public relations staff in disseminating appropriate public information. 12. Deliver general awareness training and specific task training.
13. Plan, design, and conduct exercises.
14. Organize and manage an organizational command center. 15. Coordinate, or support disaster recovery operations.
16. Maintain plans, standard operating procedures, and checklists. 17. Design evaluation criteria and metrics and evaluate performance.
18. Participate in an appropriate program of personal professional development. 19. Participate in the development of the profession.
Brainbench Topics
Brainbench certification in Disaster Recovery and Planning is based on 10 topics (Brainbench 2003a):
• Asset management
• Backups and offsite storage • Communications
• Disaster prevention (avoidance) • Essential concepts and terminology • Exposure and risk analysis
• Planning fundamentals • Preparation essentials • Recovery/interim restoration
The “Do You Offer A Course” Phenomenon
We routinely receive requests to provide a course to prepare professionals to pass our certification examination. The model of a preparatory course followed by the examination on the last day is a standard model practitioners have come to accept as the true way. The obvious question is why business continuity practitioners doubt their ability to pass a professional examination based on their working knowledge and experience?
GETTING VALUE FOR MONEY Protecting and Using Your Certification
Certification costs money – like any other investment, take steps to protect it. A large number of certified individuals do not do simple things to ensure they get full value for their money. One basic step is to notify the certifier when you move. Business addresses and business e-mails in times of turbulence means you must notify the certifying agency when you change jobs, your company changes its e-mail address, you change personal Internet service provider, etc.
The most powerful tool offered by certifiers is the appellation. Keep your certifications updated on your business card, web site, and letterhead. Ensure your current certifications are listed on your resume. Where appropriate and authorized by the certification source, use the logo.
Use other features offered by certifiers. Read the newsletter to stay abreast of changes in processes and requirements. Regularly check program web sites for new information. If a forum is available, use it to exchange information with other. If a directory is offered list yourself (someone might be looking for a new staff member) and your business (to advertise and potentially promote strategic alliances). Advertise that you comply with the certification’s code of ethics. In a competitive environment, any of these services may provide an edge.
Finally, watch for fraud. With the proliferation of credentials it is simple for the unethical to misrepresent their qualifications. If you believe someone is claiming to be certified who is not, or no longer currently, certified contact the certifier. All certifiers have an interest in protecting the value and reputation of their certificate for the benefit of the people they credential.
Recertification and Continuing Professional Development
In choosing a program, choose one with continuing professional development requirements you can meet. Once certified, it is equally important to manage the recertification process. This can be either a nightmare hunt for training to meet requirements or an opportunity to identify needs in your professional development and fill those needs. In large measure the difference between the two perspectives is based on your attitude.
The Certified Recovery Planner model views recertification as a self-development exercise and requires that as part of your certification you develop a plan for the types of activities that will help you further develop as a professional. This plan is evaluated as part of certification, and your successes and lessons learned form part of the recertification process. The Disaster
Recovery Institute International model is a point system, with flexibility in the types of events that earn points, but with restrictions that require a distribution of events to meet the biennial 80 point total. The Certified Recovery Planner model is the broader in what it considers to be professional development, and the Disaster Recovery Institute International Model offers the more structured approach. The key is to start working as soon as you complete certification – in neither case can you meet your objective the last month before your renewal date.
Table 6. Continuing Professional Development Certified Recovery
Planner Disaster Recovery Institute International Brainbench
Period 2 years 2 years 3 years
System self-assessment; either case study, significant
project, or current issues examination
80 continuing education points required from conferences, training courses,
participation in tests and disasters, publications, etc.
no requirements – knowledge verified by retesting – tests may be
taken as frequently as desired Fees $100 ABCP: $100 ($50 per year) CBCP: $150 ($75 per year) MBCP: $200 ($100 per year) $49.95 REFERENCES
Barnhart, Phillip A. The Guide to National Professional Certification Programs. 2nd ed. Amherst, MA: HRD Press, Inc., 1997.
Brainbench, Inc. “Brainbench – the measure of achievement.” Available at: http://www.brainbench.com. Accessed February 14, 2002.
Brainbench, Inc. “DisasterRecovery and Planning.” Available at: http://www.brainbench.com/ xml/bb/common/testcenter/taketest.xml?testId=374. Accessed April 18, 2003.
Brainbench, Inc. “Frequently Asked Questions About Brainbench Certifications.” Available at: http://www.brainbench.com/xml/bb/common/indfaqs.xml. Accessed February 14, 2002. Brainbench, Inc. “’Question and Answer’ Article.” Available at: http://www.brainbench.com/
xml/bb/benchpress.xml?contented=1648. Accessed April 18, 2003.
Disaster Recovery Institute International. “Application for Professional Certification in Business Continuity/Disaster Recovery Planning.” Form. Falls Church, VA: Disaster Recovery Institute International, 2000.
Disaster Recovery Institute International. “Certification Information.” Available at: http://www.drii.org/displaycommon.cfm?an=7. Accessed April 20, 2003.
Disaster Recovery Institute International. “DRI Registration – U. S. Courses.” Form. Available at: http://www.drii.org/crsappht.htm. Accessed February 13, 2002.
Disaster Recovery Institute International. “Education Program.” Available at: http://www.dri.org/educate.htm. Accessed February 13, 2002.
http://www.drii.org/certification.html.
Green, Walter G., III. A Study of Core Functions in Emergency Management as Reflected in Training Requirements for Professional Certification. Parkland, FL: Dissertation.com, 1999.
Guzman, Al. “Letter to the Editor.” Certification Magazine. April 2003. p. 11. Institute of Education. “ACP Curriculum.” Available at:
http://www.ioeducation.com/acp_main.asp?. Accessed February 13, 2002. Institute of Education. “CCP Curriculum.” Available at:
http://www.ioeducation.com/ccp_main.asp?. Accessed February 13, 2002. Institute of Education Administrator ([email protected]), “Professional Association
Presentation Information Request,” e-mail to the author ([email protected]), February 13, 2002.
Martinez, Anne. Get Certified and Get Ahead. New York, NY: McGraw-Hill, 2001. MLC & Associates, Inc. “Certification.” Available at: http://www8.iwebcenters.com/
mlcassociatesinc/training_cert.ivnu. Accessed April 19, 2003.
MLC & Associates, Inc. “Education and Training: Online BC Certification Program.” Available at: http://www.mlc2resq.com/training_certification.html. Accessed February 11, 2002. Saracco, Don, President, Executive Vice President and Chief Operating Officer, MLC &
Associates, Inc., ([email protected]), “CCPD Certification,” e-mail to the author ([email protected]), February 13, 2002.
Saracco, Don, President, Executive Vice President and Chief Operating Officer, MLC & Associates, Inc., ([email protected]), “CCPD Certification,” e-mail to the author ([email protected]), December 20, 2001.
Sharp, John, Chief Executive Officer, The Business Continuity Institute,
([email protected]), “BCI,” e-mail to the author ([email protected]), February 8, 2002.
Sharp, John. “The Origins and Current State of the Art In Risk and Business Continuity Management.” White paper. Dorcester, United Kingdom: The Business Continuity Institute, 2001.
Taylor, Benny D., President, Disaster Recovery Institute International, ([email protected]), “Certification for the Business Continuity/Disaster Recovery Industry,” e-mail to the author ([email protected]), February 8, 2002.
The Business Continuity Institute. “2002-2003 – BCI Membership Fee Structures.” Available at: http://www.thebci.org/currentfees.html. Accessed April 19, 2003.
The Business Continuity Institute. “About BCI.” White paper. Worcester, United Kingdom: The Business Continuity Institute, 2001.
The Business Continuity Institute. “The Ten Certification Standards For Business Continuity Practitioners.” Available at: http://www.thebci.org/certification_standards.html. Accessed November 24, 2001.
University of Richmond. “Certified Recovery Planner Competencies.” Available at: http://www. recoveryplanner.org/CRPcompetency.html. Accessed April13, 2003.
